ZATCA Phase 2 e-invoicing for KSA construction — what GCC contractors need to know
ZATCA's Fatoorah Phase 2 mandates real-time invoice submission. Here's what KSA-active contractors must put in place before audit risk hits.
If you're a UAE contractor with KSA projects — or a KSA contractor of any size — ZATCA's Fatoorah Phase 2 isn't optional. Every B2B invoice above the threshold needs to be cryptographically signed, submitted to ZATCA's API in real time, and stamped with a QR code before delivery to the customer.
Doing that on a spreadsheet doesn't work. Doing it as a manual upload after each invoice doesn't either — Phase 2 requires the platform that issues the invoice to be the platform that signs and submits it.
The five Phase-2 obligations
- Onboarding. Your CSID and PCSID (production cryptographic IDs) are registered with ZATCA via the Fatoor portal; without them, no invoice you issue is valid.
- XML wire format. Every invoice generates UBL 2.1 XML with all ZATCA-mandated fields (categorisation code, exemption reason, currency code, supply place, etc.).
- Cryptographic signature. A digital signature using the registered CSID is appended to the XML.
- Real-time submission. The signed XML is POSTed to ZATCA's clearance endpoint. The platform receives an Invoice Hash and a QR code back.
- Delivery to customer. The PDF given to the customer embeds the QR code (which ZATCA inspectors can scan to verify) and references the Invoice Hash.
Miss any of those, and the invoice is considered non-compliant. Penalties escalate with repetition.
Where contractor accounting tools fall short
Most generic ERPs handle KSA VAT (5%) without trouble. Phase 2 is a different problem because it isn't just a tax calculation — it's a real-time integration with a government API, signed with credentials held by the issuing platform, that has to be reliable enough to issue on the same business day the work is delivered.
Spreadsheet + manual upload doesn't scale. A generic ERP plugin that batches uploads overnight may be technically compliant on a slow week and embarrassingly out of compliance during a busy month-end.
What ORKSTRA does
ORKSTRA's KSA tax engine ships with the Phase 2 onboarding flow built in. Your CSID and PCSID are provisioned at tenant setup. Every invoice generated on a KSA-region project goes through the full clearance loop (UBL XML + CSID signature + ZATCA POST + QR embed) on the issue path. Failure modes — ZATCA endpoint unreachable, expired certificate, malformed XML — are surfaced to the finance lead, not silently buried in a log.
For UAE contractors expanding into KSA, that's the difference between treating Phase 2 as a project (months of integration work) and treating it as a setting (a checkbox at project setup).
The FTA's UAE e-invoicing mandate is following ZATCA's playbook closely. If you're building the workflow now for KSA, the UAE rollout will be a configuration change, not a second project.